Security audit

creat-anget

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly what it claims to be, but it creates persistent agents while copying main-agent credentials and handling bot secrets in ways users should review carefully before installing.

Review this skill before installing. Use it only in a controlled OpenClaw environment, avoid passing real Feishu secrets on the command line, restrict openclaw.json permissions, do not expose open Feishu group access unless intended, and provision minimal per-Agent credentials instead of copying the main Agent auth profile.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/create_standalone_agent.py:84
Finding: Unrestricted destination paths permit arbitrary file and directory modification
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/create_standalone_agent.py:208
Finding: Main-agent authentication profiles are copied into every new Agent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/create_standalone_agent.py:275
Finding: Feishu application secrets are exposed through command-line arguments and plaintext configuration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/create_standalone_agent.py:275
Finding: Feishu bot accounts are configured with open group access by default
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明强调的是“创建具有独立工作区和配置的独立 OpenClaw Agent”，适用于完全隔离的 Agent，并支持飞书机器人绑定。这意味着代码应当至少体现出独立环境初始化、配置隔离、身份/实例隔离，或与飞书集成相关的逻辑。实际代码仅是一个参数组装器：接收 task、label、runtime、mode 等参数，输出一个 action=spawn_agent 的 JSON 结构，供其他调用方使用。它没有执行任何工作区创建、配置写入、身份管理、隔离资源初始化或飞书绑定动作。相反，代码和注释都表明其主要用途是“生成新的子 Agent”的辅助脚本，默认 runtime 也是 subagent。虽然支持 acp runtime 和 cwd 等参数，但这不足以证明其实现了声明中的“独立 Agent + 飞书绑定”核心能力。因此描述与实际行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs creation of directories, modification of configuration files, and workspace initialization, which clearly implies file read/write capability, yet it declares no explicit tool scope or allowed-tools boundary. In an agent environment, missing scope declarations can lead to broader-than-expected filesystem access and make it harder for reviewers or runtime policy to constrain what the skill may touch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly includes Feishu app secrets in command-line examples and configuration snippets, and only briefly notes to be careful with secrets. Passing secrets on the command line or storing them in broadly readable config files can expose credentials through shell history, process listings, logs, screenshots, or weak file permissions, enabling takeover of the associated bot integration.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation shows plaintext application secrets in configuration examples, which encourages readers to handle credentials casually and may lead to accidental reuse of real secrets in docs, configs, tickets, or version control. In the context of creating standalone agents with external Feishu bindings, exposure of app credentials could let an attacker impersonate or tamper with the bot integration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The example command includes a Feishu app secret directly as a command-line argument, which can expose the credential through shell history, process listings, terminal logs, screenshots, and CI/job telemetry. In a guide for creating deployed agents and bot bindings, this normalizes an unsafe secret-handling pattern that operators may copy verbatim into real environments.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The example instructs users to type a secret directly on the shell command line, which risks disclosure via shell history, process monitoring tools, crash reports, and administrative audit logs. Because this skill is intended for operational setup of real agents and messaging integrations, users are likely to copy the pattern into production setup steps, increasing the chance of credential leakage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file includes natural-language documentation, usage text, and argument help exclusively in Chinese. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language strings, help text, errors, and generated markdown templates predominantly in Chinese, which imposes a specific language on users. The file does not provide any opt-in, fallback, or justification that the skill is intended only for Chinese-speaking users or a China-specific deployment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: 全文以中文提供操作说明和结果描述，没有说明这是面向特定中文用户群体的区域化文档，也未提供其他语言或用户选择语言的方式。按规则，若技能或说明强制单一语言且无用户 opt-in，可能构成自然语言层面的语言政策问题。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.